@verdaccio/config 7.0.0-next.3 → 7.0.0-next.5

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @verdaccio/config
 
+## 7.0.0-next.5
+
+### Minor Changes
+
+- f047cc8: refactor: auth with legacy sign support
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+  - @verdaccio/utils@7.0.0-next.5
+
+## 7.0.0-next.4
+
+### Patch Changes
+
+- @verdaccio/core@7.0.0-next.4
+- @verdaccio/utils@7.0.0-next.4
+
 ## 7.0.0-next.3
 
 ### Major Changes
@@ -218,12 +237,12 @@
 - 8f43bf17d: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
   app.listen(4000, (event) => {
     // do something
@@ -993,14 +1012,14 @@
 - 5c5057fc: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
-  app.listen(4000, event => {
+  app.listen(4000, (event) => {
     // do something
   });
   ```

package/build/config.d.ts

@@ -32,6 +32,7 @@ declare class Config implements AppConfig {
     }, configOptions?: {
         forceEnhancedLegacySignature: boolean;
     });
+    getEnhancedLegacySignature(): boolean;
     getConfigPath(): string;
     /**
      * Check for package spec

package/build/config.js

@@ -20,11 +20,10 @@ function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { de
 const strategicConfigProps = ['uplinks', 'packages'];
 const allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];
 const debug = (0, _debug.default)('verdaccio:config');
-const WEB_TITLE = 'Verdaccio';
+const WEB_TITLE = exports.WEB_TITLE = 'Verdaccio';
 
 // we limit max 1000 request per 15 minutes on user endpoints
-exports.WEB_TITLE = WEB_TITLE;
-const defaultUserRateLimiting = {
+const defaultUserRateLimiting = exports.defaultUserRateLimiting = {
   windowMs: 15 * 60 * 1000,
   // 15 minutes
   max: 1000
@@ -33,7 +32,6 @@ const defaultUserRateLimiting = {
 /**
  * Coordinates the application configuration
  */
-exports.defaultUserRateLimiting = defaultUserRateLimiting;
 class Config {
   /**
    * @deprecated use configPath or config.getConfigPath();
@@ -41,7 +39,12 @@ class Config {
 
   // @ts-ignore
 
-  constructor(config, configOptions = {
+  constructor(config,
+  // forceEnhancedLegacySignature is a property that
+  // allows switch a new legacy aes signature token signature
+  // for older versions do not want to have this new signature model
+  // this property must be false
+  configOptions = {
     forceEnhancedLegacySignature: true
   }) {
     var _config$flags$searchR, _config$flags, _config$flags$changeP, _config$flags2;
@@ -109,6 +112,15 @@ class Config {
       this.server_id = (0, _utils.generateRandomHexString)(6);
     }
   }
+  getEnhancedLegacySignature() {
+    if (typeof (this === null || this === void 0 ? void 0 : this.security.enhancedLegacySignature) !== 'undefined') {
+      if (this.security.enhancedLegacySignature === true) {
+        return true;
+      }
+      return false;
+    }
+    return this.configOptions.forceEnhancedLegacySignature;
+  }
   getConfigPath() {
     return this.configPath;
   }
@@ -126,7 +138,7 @@ class Config {
    * @secret external secret key
    */
   checkSecretKey(secret) {
-    var _this$secret;
+    var _this$security, _this$secret;
     debug('check secret key');
     if (typeof secret === 'string' && _lodash.default.isEmpty(secret) === false) {
       this.secret = secret;
@@ -135,20 +147,21 @@ class Config {
     }
     // generate a new a secret key
     // FUTURE: this might be an external secret key, perhaps within config file?
-    debug('generate a new key');
-    //
-    if (this.configOptions.forceEnhancedLegacySignature) {
+    debug('generating a new secret key');
+    if (this.getEnhancedLegacySignature()) {
+      debug('key generated with "enhanced" legacy signature user config');
       this.secret = (0, _token.generateRandomSecretKey)();
     } else {
-      this.secret = this.security.enhancedLegacySignature === true ? (0, _token.generateRandomSecretKey)() : (0, _utils.generateRandomHexString)(32);
-      // set this to false allow use old token signature and is not recommended
-      // only use for migration reasons, major release will remove this property and
-      // set it by default
-      if (this.security.enhancedLegacySignature === false) {
-        _core.warningUtils.emit(_warningUtils.Codes.VERWAR005);
-      }
+      debug('key generated with legacy signature user config');
+      this.secret = (0, _utils.generateRandomHexString)(32);
+    }
+    // set this to false allow use old token signature and is not recommended
+    // only use for migration reasons, major release will remove this property and
+    // set it by default
+    if (((_this$security = this.security) === null || _this$security === void 0 ? void 0 : _this$security.enhancedLegacySignature) === false) {
+      _core.warningUtils.emit(_warningUtils.Codes.VERWAR005);
     }
-    debug('generated a new secret key %s', (_this$secret = this.secret) === null || _this$secret === void 0 ? void 0 : _this$secret.length);
+    debug('generated a new secret key length %s', (_this$secret = this.secret) === null || _this$secret === void 0 ? void 0 : _this$secret.length);
     return this.secret;
   }
 }

package/build/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","names":["_assert","_interopRequireDefault","require","_debug","_lodash","_core","_warningUtils","_utils","_agent","_packageAccess","_security","_serverSettings","_token","_uplinks","obj","__esModule","default","strategicConfigProps","allowedEnvConfig","debug","buildDebug","WEB_TITLE","exports","defaultUserRateLimiting","windowMs","max","Config","constructor","config","configOptions","forceEnhancedLegacySignature","_config$flags$searchR","_config$flags","_config$flags$changeP","_config$flags2","self","storage","process","env","VERDACCIO_STORAGE_PATH","configPath","_config$config_path","config_path","self_path","Error","plugins","security","_","merge","defaultSecurity","serverSettings","flags","searchRemote","changePassword","user_agent","configProp","getUserAgent","userRateLimit","assert","isObject","APP_ERROR","CONFIG_NOT_VALID","forEach","x","uplinks","sanityCheckUplinksProps","uplinkSanityCheck","packages","normalisePackageAccess","envConf","toUpperCase","server_id","generateRandomHexString","getConfigPath","getMatchedPackagesSpec","pkgName","checkSecretKey","secret","_this$secret","isEmpty","generateRandomSecretKey","enhancedLegacySignature","warningUtils","emit","Codes","VERWAR005","length"],"sources":["../src/config.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { APP_ERROR, warningUtils } from '@verdaccio/core';\nimport { Codes } from '@verdaccio/core/build/warning-utils';\nimport {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\nimport { generateRandomHexString, getMatchedPackagesSpec, isObject } from '@verdaccio/utils';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport serverSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public serverSettings: ServerSettingsConf;\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  private configOptions: { forceEnhancedLegacySignature: boolean };\n  public constructor(\n    config: ConfigYaml & { config_path: string },\n    configOptions = { forceEnhancedLegacySignature: true }\n  ) {\n    const self = this;\n    this.configOptions = configOptions;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(defaultSecurity, config.security);\n    this.serverSettings = serverSettings;\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(_.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = generateRandomHexString(6);\n    }\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Store or create whether receive a secret key\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('check secret key');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      this.secret = secret;\n      debug('reusing previous key');\n      return secret;\n    }\n    // generate a new a secret key\n    // FUTURE: this might be an external secret key, perhaps within config file?\n    debug('generate a new key');\n    //\n    if (this.configOptions.forceEnhancedLegacySignature) {\n      this.secret = generateRandomSecretKey();\n    } else {\n      this.secret =\n        this.security.enhancedLegacySignature === true\n          ? generateRandomSecretKey()\n          : generateRandomHexString(32);\n      // set this to false allow use old token signature and is not recommended\n      // only use for migration reasons, major release will remove this property and\n      // set it by default\n      if (this.security.enhancedLegacySignature === false) {\n        warningUtils.emit(Codes.VERWAR005);\n      }\n    }\n\n    debug('generated a new secret key %s', this.secret?.length);\n    return this.secret;\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,MAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AACA,IAAAI,aAAA,GAAAJ,OAAA;AAYA,IAAAK,MAAA,GAAAL,OAAA;AAEA,IAAAM,MAAA,GAAAN,OAAA;AACA,IAAAO,cAAA,GAAAP,OAAA;AACA,IAAAQ,SAAA,GAAAR,OAAA;AACA,IAAAS,eAAA,GAAAV,sBAAA,CAAAC,OAAA;AACA,IAAAU,MAAA,GAAAV,OAAA;AACA,IAAAW,QAAA,GAAAX,OAAA;AAAuE,SAAAD,uBAAAa,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEvE,MAAMG,oBAAoB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC;AACpD,MAAMC,gBAAgB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC;AAClE,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,kBAAkB,CAAC;AAErC,MAAMC,SAAS,GAAG,WAAW;;AAEpC;AAAAC,OAAA,CAAAD,SAAA,GAAAA,SAAA;AACO,MAAME,uBAAuB,GAAG;EACrCC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;EAAE;EAC1BC,GAAG,EAAE;AACP,CAAC;;AAED;AACA;AACA;AAFAH,OAAA,CAAAC,uBAAA,GAAAA,uBAAA;AAGA,MAAMG,MAAM,CAAsB;EAQhC;AACF;AACA;;EAOE;;EAKOC,WAAWA,CAChBC,MAA4C,EAC5CC,aAAa,GAAG;IAAEC,4BAA4B,EAAE;EAAK,CAAC,EACtD;IAAA,IAAAC,qBAAA,EAAAC,aAAA,EAAAC,qBAAA,EAAAC,cAAA;IACA,MAAMC,IAAI,GAAG,IAAI;IACjB,IAAI,CAACN,aAAa,GAAGA,aAAa;IAClC,IAAI,CAACO,OAAO,GAAGC,OAAO,CAACC,GAAG,CAACC,sBAAsB,IAAIX,MAAM,CAACQ,OAAO;IACnE,IAAI,CAACR,MAAM,CAACY,UAAU,EAAE;MAAA,IAAAC,mBAAA;MACtB;MACA;MACAb,MAAM,CAACY,UAAU,IAAAC,mBAAA,GAAGb,MAAM,CAACc,WAAW,cAAAD,mBAAA,cAAAA,mBAAA,GAAIb,MAAM,CAACe,SAAS;MAC1D,IAAI,CAACf,MAAM,CAACY,UAAU,EAAE;QACtB,MAAM,IAAII,KAAK,CAAC,iCAAiC,CAAC;MACpD;IACF;IACA,IAAI,CAACJ,UAAU,GAAGZ,MAAM,CAACY,UAAU;IACnC,IAAI,CAACG,SAAS,GAAG,IAAI,CAACH,UAAU;IAChCrB,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAACqB,UAAU,CAAC;IACzC,IAAI,CAACK,OAAO,GAAGjB,MAAM,CAACiB,OAAO;IAC7B,IAAI,CAACC,QAAQ,GAAGC,eAAC,CAACC,KAAK,CAACC,yBAAe,EAAErB,MAAM,CAACkB,QAAQ,CAAC;IACzD,IAAI,CAACI,cAAc,GAAGA,uBAAc;IACpC,IAAI,CAACC,KAAK,GAAG;MACXC,YAAY,GAAArB,qBAAA,IAAAC,aAAA,GAAEJ,MAAM,CAACuB,KAAK,cAAAnB,aAAA,uBAAZA,aAAA,CAAcoB,YAAY,cAAArB,qBAAA,cAAAA,qBAAA,GAAI,IAAI;MAChDsB,cAAc,GAAApB,qBAAA,IAAAC,cAAA,GAAEN,MAAM,CAACuB,KAAK,cAAAjB,cAAA,uBAAZA,cAAA,CAAcmB,cAAc,cAAApB,qBAAA,cAAAA,qBAAA,GAAI;IAClD,CAAC;IACD,IAAI,CAACqB,UAAU,GAAG1B,MAAM,CAAC0B,UAAU;IAEnC,KAAK,MAAMC,UAAU,IAAI3B,MAAM,EAAE;MAC/B,IAAIO,IAAI,CAACoB,UAAU,CAAC,IAAI,IAAI,EAAE;QAC5BpB,IAAI,CAACoB,UAAU,CAAC,GAAG3B,MAAM,CAAC2B,UAAU,CAAC;MACvC;IACF;IAEA,IAAI,OAAO,IAAI,CAACD,UAAU,KAAK,WAAW,EAAE;MAC1C;MACAnC,KAAK,CAAC,wBAAwB,CAAC;MAC/B,IAAI,CAACmC,UAAU,GAAG,IAAAE,mBAAY,EAAC,KAAK,CAAC;IACvC;IAEA,IAAI,CAACC,aAAa,GAAG;MAAE,GAAGlC,uBAAuB;MAAE,IAAGK,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAE6B,aAAa;IAAC,CAAC;;IAE7E;IACA,IAAAC,eAAM,EAACX,eAAC,CAACY,QAAQ,CAAC/B,MAAM,CAAC,EAAEgC,eAAS,CAACC,gBAAgB,CAAC;;IAEtD;IACA5C,oBAAoB,CAAC6C,OAAO,CAAC,UAAUC,CAAC,EAAQ;MAC9C,IAAI5B,IAAI,CAAC4B,CAAC,CAAC,IAAI,IAAI,EAAE;QACnB5B,IAAI,CAAC4B,CAAC,CAAC,GAAG,CAAC,CAAC;MACd;MAEA,IAAAL,eAAM,EAAC,IAAAC,eAAQ,EAACxB,IAAI,CAAC4B,CAAC,CAAC,CAAC,EAAG,gBAAeA,CAAE,2BAA0B,CAAC;IACzE,CAAC,CAAC;IAEF,IAAI,CAACC,OAAO,GAAG,IAAAC,gCAAuB,EAAC,IAAAC,0BAAiB,EAAC,IAAI,CAACF,OAAO,CAAC,CAAC;IACvE,IAAI,CAACG,QAAQ,GAAG,IAAAC,qCAAsB,EAACjC,IAAI,CAACgC,QAAQ,CAAC;;IAErD;IACAjD,gBAAgB,CAAC4C,OAAO,CAAEO,OAAO,IAAW;MAC1C,IAAI,EAAEA,OAAO,IAAIlC,IAAI,CAAC,EAAE;QACtBA,IAAI,CAACkC,OAAO,CAAC,GAAGhC,OAAO,CAACC,GAAG,CAAC+B,OAAO,CAAC,IAAIhC,OAAO,CAACC,GAAG,CAAC+B,OAAO,CAACC,WAAW,CAAC,CAAC,CAAC;MAC5E;IACF,CAAC,CAAC;;IAEF;IACA;IACA,IAAI,CAAC,IAAI,CAACC,SAAS,EAAE;MACnB,IAAI,CAACA,SAAS,GAAG,IAAAC,8BAAuB,EAAC,CAAC,CAAC;IAC7C;EACF;EAEOC,aAAaA,CAAA,EAAG;IACrB,OAAO,IAAI,CAACjC,UAAU;EACxB;;EAEA;AACF;AACA;EACSkC,sBAAsBA,CAACC,OAAe,EAAwB;IACnE;IACA,OAAO,IAAAD,6BAAsB,EAACC,OAAO,EAAE,IAAI,CAACR,QAAQ,CAAC;EACvD;;EAEA;AACF;AACA;AACA;EACSS,cAAcA,CAACC,MAAe,EAAU;IAAA,IAAAC,YAAA;IAC7C3D,KAAK,CAAC,kBAAkB,CAAC;IACzB,IAAI,OAAO0D,MAAM,KAAK,QAAQ,IAAI9B,eAAC,CAACgC,OAAO,CAACF,MAAM,CAAC,KAAK,KAAK,EAAE;MAC7D,IAAI,CAACA,MAAM,GAAGA,MAAM;MACpB1D,KAAK,CAAC,sBAAsB,CAAC;MAC7B,OAAO0D,MAAM;IACf;IACA;IACA;IACA1D,KAAK,CAAC,oBAAoB,CAAC;IAC3B;IACA,IAAI,IAAI,CAACU,aAAa,CAACC,4BAA4B,EAAE;MACnD,IAAI,CAAC+C,MAAM,GAAG,IAAAG,8BAAuB,EAAC,CAAC;IACzC,CAAC,MAAM;MACL,IAAI,CAACH,MAAM,GACT,IAAI,CAAC/B,QAAQ,CAACmC,uBAAuB,KAAK,IAAI,GAC1C,IAAAD,8BAAuB,EAAC,CAAC,GACzB,IAAAR,8BAAuB,EAAC,EAAE,CAAC;MACjC;MACA;MACA;MACA,IAAI,IAAI,CAAC1B,QAAQ,CAACmC,uBAAuB,KAAK,KAAK,EAAE;QACnDC,kBAAY,CAACC,IAAI,CAACC,mBAAK,CAACC,SAAS,CAAC;MACpC;IACF;IAEAlE,KAAK,CAAC,+BAA+B,GAAA2D,YAAA,GAAE,IAAI,CAACD,MAAM,cAAAC,YAAA,uBAAXA,YAAA,CAAaQ,MAAM,CAAC;IAC3D,OAAO,IAAI,CAACT,MAAM;EACpB;AACF;AAACvD,OAAA,CAAAI,MAAA,GAAAA,MAAA"}
+{"version":3,"file":"config.js","names":["_assert","_interopRequireDefault","require","_debug","_lodash","_core","_warningUtils","_utils","_agent","_packageAccess","_security","_serverSettings","_token","_uplinks","obj","__esModule","default","strategicConfigProps","allowedEnvConfig","debug","buildDebug","WEB_TITLE","exports","defaultUserRateLimiting","windowMs","max","Config","constructor","config","configOptions","forceEnhancedLegacySignature","_config$flags$searchR","_config$flags","_config$flags$changeP","_config$flags2","self","storage","process","env","VERDACCIO_STORAGE_PATH","configPath","_config$config_path","config_path","self_path","Error","plugins","security","_","merge","defaultSecurity","serverSettings","flags","searchRemote","changePassword","user_agent","configProp","getUserAgent","userRateLimit","assert","isObject","APP_ERROR","CONFIG_NOT_VALID","forEach","x","uplinks","sanityCheckUplinksProps","uplinkSanityCheck","packages","normalisePackageAccess","envConf","toUpperCase","server_id","generateRandomHexString","getEnhancedLegacySignature","enhancedLegacySignature","getConfigPath","getMatchedPackagesSpec","pkgName","checkSecretKey","secret","_this$security","_this$secret","isEmpty","generateRandomSecretKey","warningUtils","emit","Codes","VERWAR005","length"],"sources":["../src/config.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { APP_ERROR, warningUtils } from '@verdaccio/core';\nimport { Codes } from '@verdaccio/core/build/warning-utils';\nimport {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\nimport { generateRandomHexString, getMatchedPackagesSpec, isObject } from '@verdaccio/utils';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport serverSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public serverSettings: ServerSettingsConf;\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  private configOptions: { forceEnhancedLegacySignature: boolean };\n  public constructor(\n    config: ConfigYaml & { config_path: string },\n    // forceEnhancedLegacySignature is a property that\n    // allows switch a new legacy aes signature token signature\n    // for older versions do not want to have this new signature model\n    // this property must be false\n    configOptions = { forceEnhancedLegacySignature: true }\n  ) {\n    const self = this;\n    this.configOptions = configOptions;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(defaultSecurity, config.security);\n    this.serverSettings = serverSettings;\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(_.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = generateRandomHexString(6);\n    }\n  }\n\n  public getEnhancedLegacySignature() {\n    if (typeof this?.security.enhancedLegacySignature !== 'undefined') {\n      if (this.security.enhancedLegacySignature === true) {\n        return true;\n      }\n      return false;\n    }\n    return this.configOptions.forceEnhancedLegacySignature;\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Store or create whether receive a secret key\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('check secret key');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      this.secret = secret;\n      debug('reusing previous key');\n      return secret;\n    }\n    // generate a new a secret key\n    // FUTURE: this might be an external secret key, perhaps within config file?\n    debug('generating a new secret key');\n\n    if (this.getEnhancedLegacySignature()) {\n      debug('key generated with \"enhanced\" legacy signature user config');\n      this.secret = generateRandomSecretKey();\n    } else {\n      debug('key generated with legacy signature user config');\n      this.secret = generateRandomHexString(32);\n    }\n    // set this to false allow use old token signature and is not recommended\n    // only use for migration reasons, major release will remove this property and\n    // set it by default\n    if (this.security?.enhancedLegacySignature === false) {\n      warningUtils.emit(Codes.VERWAR005);\n    }\n\n    debug('generated a new secret key length %s', this.secret?.length);\n    return this.secret;\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,MAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AACA,IAAAI,aAAA,GAAAJ,OAAA;AAYA,IAAAK,MAAA,GAAAL,OAAA;AAEA,IAAAM,MAAA,GAAAN,OAAA;AACA,IAAAO,cAAA,GAAAP,OAAA;AACA,IAAAQ,SAAA,GAAAR,OAAA;AACA,IAAAS,eAAA,GAAAV,sBAAA,CAAAC,OAAA;AACA,IAAAU,MAAA,GAAAV,OAAA;AACA,IAAAW,QAAA,GAAAX,OAAA;AAAuE,SAAAD,uBAAAa,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEvE,MAAMG,oBAAoB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC;AACpD,MAAMC,gBAAgB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC;AAClE,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,kBAAkB,CAAC;AAErC,MAAMC,SAAS,GAAAC,OAAA,CAAAD,SAAA,GAAG,WAAW;;AAEpC;AACO,MAAME,uBAAuB,GAAAD,OAAA,CAAAC,uBAAA,GAAG;EACrCC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;EAAE;EAC1BC,GAAG,EAAE;AACP,CAAC;;AAED;AACA;AACA;AACA,MAAMC,MAAM,CAAsB;EAQhC;AACF;AACA;;EAOE;;EAKOC,WAAWA,CAChBC,MAA4C;EAC5C;EACA;EACA;EACA;EACAC,aAAa,GAAG;IAAEC,4BAA4B,EAAE;EAAK,CAAC,EACtD;IAAA,IAAAC,qBAAA,EAAAC,aAAA,EAAAC,qBAAA,EAAAC,cAAA;IACA,MAAMC,IAAI,GAAG,IAAI;IACjB,IAAI,CAACN,aAAa,GAAGA,aAAa;IAClC,IAAI,CAACO,OAAO,GAAGC,OAAO,CAACC,GAAG,CAACC,sBAAsB,IAAIX,MAAM,CAACQ,OAAO;IACnE,IAAI,CAACR,MAAM,CAACY,UAAU,EAAE;MAAA,IAAAC,mBAAA;MACtB;MACA;MACAb,MAAM,CAACY,UAAU,IAAAC,mBAAA,GAAGb,MAAM,CAACc,WAAW,cAAAD,mBAAA,cAAAA,mBAAA,GAAIb,MAAM,CAACe,SAAS;MAC1D,IAAI,CAACf,MAAM,CAACY,UAAU,EAAE;QACtB,MAAM,IAAII,KAAK,CAAC,iCAAiC,CAAC;MACpD;IACF;IACA,IAAI,CAACJ,UAAU,GAAGZ,MAAM,CAACY,UAAU;IACnC,IAAI,CAACG,SAAS,GAAG,IAAI,CAACH,UAAU;IAChCrB,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAACqB,UAAU,CAAC;IACzC,IAAI,CAACK,OAAO,GAAGjB,MAAM,CAACiB,OAAO;IAC7B,IAAI,CAACC,QAAQ,GAAGC,eAAC,CAACC,KAAK,CAACC,yBAAe,EAAErB,MAAM,CAACkB,QAAQ,CAAC;IACzD,IAAI,CAACI,cAAc,GAAGA,uBAAc;IACpC,IAAI,CAACC,KAAK,GAAG;MACXC,YAAY,GAAArB,qBAAA,IAAAC,aAAA,GAAEJ,MAAM,CAACuB,KAAK,cAAAnB,aAAA,uBAAZA,aAAA,CAAcoB,YAAY,cAAArB,qBAAA,cAAAA,qBAAA,GAAI,IAAI;MAChDsB,cAAc,GAAApB,qBAAA,IAAAC,cAAA,GAAEN,MAAM,CAACuB,KAAK,cAAAjB,cAAA,uBAAZA,cAAA,CAAcmB,cAAc,cAAApB,qBAAA,cAAAA,qBAAA,GAAI;IAClD,CAAC;IACD,IAAI,CAACqB,UAAU,GAAG1B,MAAM,CAAC0B,UAAU;IAEnC,KAAK,MAAMC,UAAU,IAAI3B,MAAM,EAAE;MAC/B,IAAIO,IAAI,CAACoB,UAAU,CAAC,IAAI,IAAI,EAAE;QAC5BpB,IAAI,CAACoB,UAAU,CAAC,GAAG3B,MAAM,CAAC2B,UAAU,CAAC;MACvC;IACF;IAEA,IAAI,OAAO,IAAI,CAACD,UAAU,KAAK,WAAW,EAAE;MAC1C;MACAnC,KAAK,CAAC,wBAAwB,CAAC;MAC/B,IAAI,CAACmC,UAAU,GAAG,IAAAE,mBAAY,EAAC,KAAK,CAAC;IACvC;IAEA,IAAI,CAACC,aAAa,GAAG;MAAE,GAAGlC,uBAAuB;MAAE,IAAGK,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAE6B,aAAa;IAAC,CAAC;;IAE7E;IACA,IAAAC,eAAM,EAACX,eAAC,CAACY,QAAQ,CAAC/B,MAAM,CAAC,EAAEgC,eAAS,CAACC,gBAAgB,CAAC;;IAEtD;IACA5C,oBAAoB,CAAC6C,OAAO,CAAC,UAAUC,CAAC,EAAQ;MAC9C,IAAI5B,IAAI,CAAC4B,CAAC,CAAC,IAAI,IAAI,EAAE;QACnB5B,IAAI,CAAC4B,CAAC,CAAC,GAAG,CAAC,CAAC;MACd;MAEA,IAAAL,eAAM,EAAC,IAAAC,eAAQ,EAACxB,IAAI,CAAC4B,CAAC,CAAC,CAAC,EAAG,gBAAeA,CAAE,2BAA0B,CAAC;IACzE,CAAC,CAAC;IAEF,IAAI,CAACC,OAAO,GAAG,IAAAC,gCAAuB,EAAC,IAAAC,0BAAiB,EAAC,IAAI,CAACF,OAAO,CAAC,CAAC;IACvE,IAAI,CAACG,QAAQ,GAAG,IAAAC,qCAAsB,EAACjC,IAAI,CAACgC,QAAQ,CAAC;;IAErD;IACAjD,gBAAgB,CAAC4C,OAAO,CAAEO,OAAO,IAAW;MAC1C,IAAI,EAAEA,OAAO,IAAIlC,IAAI,CAAC,EAAE;QACtBA,IAAI,CAACkC,OAAO,CAAC,GAAGhC,OAAO,CAACC,GAAG,CAAC+B,OAAO,CAAC,IAAIhC,OAAO,CAACC,GAAG,CAAC+B,OAAO,CAACC,WAAW,CAAC,CAAC,CAAC;MAC5E;IACF,CAAC,CAAC;;IAEF;IACA;IACA,IAAI,CAAC,IAAI,CAACC,SAAS,EAAE;MACnB,IAAI,CAACA,SAAS,GAAG,IAAAC,8BAAuB,EAAC,CAAC,CAAC;IAC7C;EACF;EAEOC,0BAA0BA,CAAA,EAAG;IAClC,IAAI,QAAO,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE3B,QAAQ,CAAC4B,uBAAuB,MAAK,WAAW,EAAE;MACjE,IAAI,IAAI,CAAC5B,QAAQ,CAAC4B,uBAAuB,KAAK,IAAI,EAAE;QAClD,OAAO,IAAI;MACb;MACA,OAAO,KAAK;IACd;IACA,OAAO,IAAI,CAAC7C,aAAa,CAACC,4BAA4B;EACxD;EAEO6C,aAAaA,CAAA,EAAG;IACrB,OAAO,IAAI,CAACnC,UAAU;EACxB;;EAEA;AACF;AACA;EACSoC,sBAAsBA,CAACC,OAAe,EAAwB;IACnE;IACA,OAAO,IAAAD,6BAAsB,EAACC,OAAO,EAAE,IAAI,CAACV,QAAQ,CAAC;EACvD;;EAEA;AACF;AACA;AACA;EACSW,cAAcA,CAACC,MAAe,EAAU;IAAA,IAAAC,cAAA,EAAAC,YAAA;IAC7C9D,KAAK,CAAC,kBAAkB,CAAC;IACzB,IAAI,OAAO4D,MAAM,KAAK,QAAQ,IAAIhC,eAAC,CAACmC,OAAO,CAACH,MAAM,CAAC,KAAK,KAAK,EAAE;MAC7D,IAAI,CAACA,MAAM,GAAGA,MAAM;MACpB5D,KAAK,CAAC,sBAAsB,CAAC;MAC7B,OAAO4D,MAAM;IACf;IACA;IACA;IACA5D,KAAK,CAAC,6BAA6B,CAAC;IAEpC,IAAI,IAAI,CAACsD,0BAA0B,CAAC,CAAC,EAAE;MACrCtD,KAAK,CAAC,4DAA4D,CAAC;MACnE,IAAI,CAAC4D,MAAM,GAAG,IAAAI,8BAAuB,EAAC,CAAC;IACzC,CAAC,MAAM;MACLhE,KAAK,CAAC,iDAAiD,CAAC;MACxD,IAAI,CAAC4D,MAAM,GAAG,IAAAP,8BAAuB,EAAC,EAAE,CAAC;IAC3C;IACA;IACA;IACA;IACA,IAAI,EAAAQ,cAAA,OAAI,CAAClC,QAAQ,cAAAkC,cAAA,uBAAbA,cAAA,CAAeN,uBAAuB,MAAK,KAAK,EAAE;MACpDU,kBAAY,CAACC,IAAI,CAACC,mBAAK,CAACC,SAAS,CAAC;IACpC;IAEApE,KAAK,CAAC,sCAAsC,GAAA8D,YAAA,GAAE,IAAI,CAACF,MAAM,cAAAE,YAAA,uBAAXA,YAAA,CAAaO,MAAM,CAAC;IAClE,OAAO,IAAI,CAACT,MAAM;EACpB;AACF;AAACzD,OAAA,CAAAI,MAAA,GAAAA,MAAA"}

package/build/package-access.js

@@ -11,7 +11,7 @@ var _lodash = _interopRequireDefault(require("lodash"));
 var _core = require("@verdaccio/core");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 // @deprecated use @verdaccio/core:authUtils
-const ROLES = {
+const ROLES = exports.ROLES = {
   $ALL: '$all',
   ALL: 'all',
   $AUTH: '$authenticated',
@@ -22,12 +22,10 @@ const ROLES = {
 };
 
 // @deprecated use @verdaccio/core:authUtils
-exports.ROLES = ROLES;
-const PACKAGE_ACCESS = {
+const PACKAGE_ACCESS = exports.PACKAGE_ACCESS = {
   SCOPE: '@*/*',
   ALL: '**'
 };
-exports.PACKAGE_ACCESS = PACKAGE_ACCESS;
 function normalizeUserList(groupsList) {
   const result = [];
   if (_lodash.default.isNil(groupsList)) {

package/build/package-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"package-access.js","names":["_assert","_interopRequireDefault","require","_lodash","_core","obj","__esModule","default","ROLES","$ALL","ALL","$AUTH","$ANONYMOUS","DEPRECATED_ALL","DEPRECATED_AUTH","DEPRECATED_ANONYMOUS","exports","PACKAGE_ACCESS","SCOPE","normalizeUserList","groupsList","result","_","isNil","isString","groupsArray","split","push","Array","isArray","errorUtils","getInternalError","JSON","stringify","flatten","normalisePackageAccess","packages","normalizedPkgs","access","publish","unpublish","proxy","pkg","Object","prototype","hasOwnProperty","call","packageAccess","isInvalid","isObject","assert","isUndefined"],"sources":["../src/package-access.ts"],"sourcesContent":["import assert from 'assert';\nimport _ from 'lodash';\n\nimport { errorUtils } from '@verdaccio/core';\nimport { PackageAccess } from '@verdaccio/types';\n\nexport interface LegacyPackageList {\n  [key: string]: PackageAccess;\n}\n\n// @deprecated use @verdaccio/core:authUtils\nexport const ROLES = {\n  $ALL: '$all',\n  ALL: 'all',\n  $AUTH: '$authenticated',\n  $ANONYMOUS: '$anonymous',\n  DEPRECATED_ALL: '@all',\n  DEPRECATED_AUTH: '@authenticated',\n  DEPRECATED_ANONYMOUS: '@anonymous',\n};\n\n// @deprecated use @verdaccio/core:authUtils\nexport const PACKAGE_ACCESS = {\n  SCOPE: '@*/*',\n  ALL: '**',\n};\n\nexport function normalizeUserList(groupsList: any): any {\n  const result: any[] = [];\n  if (_.isNil(groupsList)) {\n    return result;\n  }\n\n  // if it's a string, split it to array\n  if (_.isString(groupsList)) {\n    const groupsArray = groupsList.split(/\\s+/);\n\n    result.push(groupsArray);\n  } else if (Array.isArray(groupsList)) {\n    result.push(groupsList);\n  } else {\n    throw errorUtils.getInternalError(\n      'CONFIG: bad package acl (array or string expected): ' + JSON.stringify(groupsList)\n    );\n  }\n\n  return _.flatten(result);\n}\n\nexport function normalisePackageAccess(packages: LegacyPackageList): LegacyPackageList {\n  const normalizedPkgs: LegacyPackageList = { ...packages };\n  if (_.isNil(normalizedPkgs['**'])) {\n    normalizedPkgs['**'] = {\n      access: [],\n      publish: [],\n      unpublish: [],\n      proxy: [],\n    };\n  }\n\n  for (const pkg in packages) {\n    if (Object.prototype.hasOwnProperty.call(packages, pkg)) {\n      const packageAccess = packages[pkg];\n      const isInvalid = _.isObject(packageAccess) && _.isArray(packageAccess) === false;\n      assert(isInvalid, `CONFIG: bad \"'${pkg}'\" package description (object expected)`);\n\n      normalizedPkgs[pkg].access = normalizeUserList(packageAccess.access);\n      normalizedPkgs[pkg].publish = normalizeUserList(packageAccess.publish);\n      normalizedPkgs[pkg].proxy = normalizeUserList(packageAccess.proxy);\n      // if unpublish is not defined, we set to false to fallback in publish access\n      normalizedPkgs[pkg].unpublish = _.isUndefined(packageAccess.unpublish)\n        ? false\n        : normalizeUserList(packageAccess.unpublish);\n    }\n  }\n\n  return normalizedPkgs;\n}\n"],"mappings":";;;;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,KAAA,GAAAF,OAAA;AAA6C,SAAAD,uBAAAI,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAO7C;AACO,MAAMG,KAAK,GAAG;EACnBC,IAAI,EAAE,MAAM;EACZC,GAAG,EAAE,KAAK;EACVC,KAAK,EAAE,gBAAgB;EACvBC,UAAU,EAAE,YAAY;EACxBC,cAAc,EAAE,MAAM;EACtBC,eAAe,EAAE,gBAAgB;EACjCC,oBAAoB,EAAE;AACxB,CAAC;;AAED;AAAAC,OAAA,CAAAR,KAAA,GAAAA,KAAA;AACO,MAAMS,cAAc,GAAG;EAC5BC,KAAK,EAAE,MAAM;EACbR,GAAG,EAAE;AACP,CAAC;AAACM,OAAA,CAAAC,cAAA,GAAAA,cAAA;AAEK,SAASE,iBAAiBA,CAACC,UAAe,EAAO;EACtD,MAAMC,MAAa,GAAG,EAAE;EACxB,IAAIC,eAAC,CAACC,KAAK,CAACH,UAAU,CAAC,EAAE;IACvB,OAAOC,MAAM;EACf;;EAEA;EACA,IAAIC,eAAC,CAACE,QAAQ,CAACJ,UAAU,CAAC,EAAE;IAC1B,MAAMK,WAAW,GAAGL,UAAU,CAACM,KAAK,CAAC,KAAK,CAAC;IAE3CL,MAAM,CAACM,IAAI,CAACF,WAAW,CAAC;EAC1B,CAAC,MAAM,IAAIG,KAAK,CAACC,OAAO,CAACT,UAAU,CAAC,EAAE;IACpCC,MAAM,CAACM,IAAI,CAACP,UAAU,CAAC;EACzB,CAAC,MAAM;IACL,MAAMU,gBAAU,CAACC,gBAAgB,CAC/B,sDAAsD,GAAGC,IAAI,CAACC,SAAS,CAACb,UAAU,CACpF,CAAC;EACH;EAEA,OAAOE,eAAC,CAACY,OAAO,CAACb,MAAM,CAAC;AAC1B;AAEO,SAASc,sBAAsBA,CAACC,QAA2B,EAAqB;EACrF,MAAMC,cAAiC,GAAG;IAAE,GAAGD;EAAS,CAAC;EACzD,IAAId,eAAC,CAACC,KAAK,CAACc,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE;IACjCA,cAAc,CAAC,IAAI,CAAC,GAAG;MACrBC,MAAM,EAAE,EAAE;MACVC,OAAO,EAAE,EAAE;MACXC,SAAS,EAAE,EAAE;MACbC,KAAK,EAAE;IACT,CAAC;EACH;EAEA,KAAK,MAAMC,GAAG,IAAIN,QAAQ,EAAE;IAC1B,IAAIO,MAAM,CAACC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACV,QAAQ,EAAEM,GAAG,CAAC,EAAE;MACvD,MAAMK,aAAa,GAAGX,QAAQ,CAACM,GAAG,CAAC;MACnC,MAAMM,SAAS,GAAG1B,eAAC,CAAC2B,QAAQ,CAACF,aAAa,CAAC,IAAIzB,eAAC,CAACO,OAAO,CAACkB,aAAa,CAAC,KAAK,KAAK;MACjF,IAAAG,eAAM,EAACF,SAAS,EAAG,iBAAgBN,GAAI,0CAAyC,CAAC;MAEjFL,cAAc,CAACK,GAAG,CAAC,CAACJ,MAAM,GAAGnB,iBAAiB,CAAC4B,aAAa,CAACT,MAAM,CAAC;MACpED,cAAc,CAACK,GAAG,CAAC,CAACH,OAAO,GAAGpB,iBAAiB,CAAC4B,aAAa,CAACR,OAAO,CAAC;MACtEF,cAAc,CAACK,GAAG,CAAC,CAACD,KAAK,GAAGtB,iBAAiB,CAAC4B,aAAa,CAACN,KAAK,CAAC;MAClE;MACAJ,cAAc,CAACK,GAAG,CAAC,CAACF,SAAS,GAAGlB,eAAC,CAAC6B,WAAW,CAACJ,aAAa,CAACP,SAAS,CAAC,GAClE,KAAK,GACLrB,iBAAiB,CAAC4B,aAAa,CAACP,SAAS,CAAC;IAChD;EACF;EAEA,OAAOH,cAAc;AACvB"}
+{"version":3,"file":"package-access.js","names":["_assert","_interopRequireDefault","require","_lodash","_core","obj","__esModule","default","ROLES","exports","$ALL","ALL","$AUTH","$ANONYMOUS","DEPRECATED_ALL","DEPRECATED_AUTH","DEPRECATED_ANONYMOUS","PACKAGE_ACCESS","SCOPE","normalizeUserList","groupsList","result","_","isNil","isString","groupsArray","split","push","Array","isArray","errorUtils","getInternalError","JSON","stringify","flatten","normalisePackageAccess","packages","normalizedPkgs","access","publish","unpublish","proxy","pkg","Object","prototype","hasOwnProperty","call","packageAccess","isInvalid","isObject","assert","isUndefined"],"sources":["../src/package-access.ts"],"sourcesContent":["import assert from 'assert';\nimport _ from 'lodash';\n\nimport { errorUtils } from '@verdaccio/core';\nimport { PackageAccess } from '@verdaccio/types';\n\nexport interface LegacyPackageList {\n  [key: string]: PackageAccess;\n}\n\n// @deprecated use @verdaccio/core:authUtils\nexport const ROLES = {\n  $ALL: '$all',\n  ALL: 'all',\n  $AUTH: '$authenticated',\n  $ANONYMOUS: '$anonymous',\n  DEPRECATED_ALL: '@all',\n  DEPRECATED_AUTH: '@authenticated',\n  DEPRECATED_ANONYMOUS: '@anonymous',\n};\n\n// @deprecated use @verdaccio/core:authUtils\nexport const PACKAGE_ACCESS = {\n  SCOPE: '@*/*',\n  ALL: '**',\n};\n\nexport function normalizeUserList(groupsList: any): any {\n  const result: any[] = [];\n  if (_.isNil(groupsList)) {\n    return result;\n  }\n\n  // if it's a string, split it to array\n  if (_.isString(groupsList)) {\n    const groupsArray = groupsList.split(/\\s+/);\n\n    result.push(groupsArray);\n  } else if (Array.isArray(groupsList)) {\n    result.push(groupsList);\n  } else {\n    throw errorUtils.getInternalError(\n      'CONFIG: bad package acl (array or string expected): ' + JSON.stringify(groupsList)\n    );\n  }\n\n  return _.flatten(result);\n}\n\nexport function normalisePackageAccess(packages: LegacyPackageList): LegacyPackageList {\n  const normalizedPkgs: LegacyPackageList = { ...packages };\n  if (_.isNil(normalizedPkgs['**'])) {\n    normalizedPkgs['**'] = {\n      access: [],\n      publish: [],\n      unpublish: [],\n      proxy: [],\n    };\n  }\n\n  for (const pkg in packages) {\n    if (Object.prototype.hasOwnProperty.call(packages, pkg)) {\n      const packageAccess = packages[pkg];\n      const isInvalid = _.isObject(packageAccess) && _.isArray(packageAccess) === false;\n      assert(isInvalid, `CONFIG: bad \"'${pkg}'\" package description (object expected)`);\n\n      normalizedPkgs[pkg].access = normalizeUserList(packageAccess.access);\n      normalizedPkgs[pkg].publish = normalizeUserList(packageAccess.publish);\n      normalizedPkgs[pkg].proxy = normalizeUserList(packageAccess.proxy);\n      // if unpublish is not defined, we set to false to fallback in publish access\n      normalizedPkgs[pkg].unpublish = _.isUndefined(packageAccess.unpublish)\n        ? false\n        : normalizeUserList(packageAccess.unpublish);\n    }\n  }\n\n  return normalizedPkgs;\n}\n"],"mappings":";;;;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,KAAA,GAAAF,OAAA;AAA6C,SAAAD,uBAAAI,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAO7C;AACO,MAAMG,KAAK,GAAAC,OAAA,CAAAD,KAAA,GAAG;EACnBE,IAAI,EAAE,MAAM;EACZC,GAAG,EAAE,KAAK;EACVC,KAAK,EAAE,gBAAgB;EACvBC,UAAU,EAAE,YAAY;EACxBC,cAAc,EAAE,MAAM;EACtBC,eAAe,EAAE,gBAAgB;EACjCC,oBAAoB,EAAE;AACxB,CAAC;;AAED;AACO,MAAMC,cAAc,GAAAR,OAAA,CAAAQ,cAAA,GAAG;EAC5BC,KAAK,EAAE,MAAM;EACbP,GAAG,EAAE;AACP,CAAC;AAEM,SAASQ,iBAAiBA,CAACC,UAAe,EAAO;EACtD,MAAMC,MAAa,GAAG,EAAE;EACxB,IAAIC,eAAC,CAACC,KAAK,CAACH,UAAU,CAAC,EAAE;IACvB,OAAOC,MAAM;EACf;;EAEA;EACA,IAAIC,eAAC,CAACE,QAAQ,CAACJ,UAAU,CAAC,EAAE;IAC1B,MAAMK,WAAW,GAAGL,UAAU,CAACM,KAAK,CAAC,KAAK,CAAC;IAE3CL,MAAM,CAACM,IAAI,CAACF,WAAW,CAAC;EAC1B,CAAC,MAAM,IAAIG,KAAK,CAACC,OAAO,CAACT,UAAU,CAAC,EAAE;IACpCC,MAAM,CAACM,IAAI,CAACP,UAAU,CAAC;EACzB,CAAC,MAAM;IACL,MAAMU,gBAAU,CAACC,gBAAgB,CAC/B,sDAAsD,GAAGC,IAAI,CAACC,SAAS,CAACb,UAAU,CACpF,CAAC;EACH;EAEA,OAAOE,eAAC,CAACY,OAAO,CAACb,MAAM,CAAC;AAC1B;AAEO,SAASc,sBAAsBA,CAACC,QAA2B,EAAqB;EACrF,MAAMC,cAAiC,GAAG;IAAE,GAAGD;EAAS,CAAC;EACzD,IAAId,eAAC,CAACC,KAAK,CAACc,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE;IACjCA,cAAc,CAAC,IAAI,CAAC,GAAG;MACrBC,MAAM,EAAE,EAAE;MACVC,OAAO,EAAE,EAAE;MACXC,SAAS,EAAE,EAAE;MACbC,KAAK,EAAE;IACT,CAAC;EACH;EAEA,KAAK,MAAMC,GAAG,IAAIN,QAAQ,EAAE;IAC1B,IAAIO,MAAM,CAACC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACV,QAAQ,EAAEM,GAAG,CAAC,EAAE;MACvD,MAAMK,aAAa,GAAGX,QAAQ,CAACM,GAAG,CAAC;MACnC,MAAMM,SAAS,GAAG1B,eAAC,CAAC2B,QAAQ,CAACF,aAAa,CAAC,IAAIzB,eAAC,CAACO,OAAO,CAACkB,aAAa,CAAC,KAAK,KAAK;MACjF,IAAAG,eAAM,EAACF,SAAS,EAAG,iBAAgBN,GAAI,0CAAyC,CAAC;MAEjFL,cAAc,CAACK,GAAG,CAAC,CAACJ,MAAM,GAAGnB,iBAAiB,CAAC4B,aAAa,CAACT,MAAM,CAAC;MACpED,cAAc,CAACK,GAAG,CAAC,CAACH,OAAO,GAAGpB,iBAAiB,CAAC4B,aAAa,CAACR,OAAO,CAAC;MACtEF,cAAc,CAACK,GAAG,CAAC,CAACD,KAAK,GAAGtB,iBAAiB,CAAC4B,aAAa,CAACN,KAAK,CAAC;MAClE;MACAJ,cAAc,CAACK,GAAG,CAAC,CAACF,SAAS,GAAGlB,eAAC,CAAC6B,WAAW,CAACJ,aAAa,CAACP,SAAS,CAAC,GAClE,KAAK,GACLrB,iBAAiB,CAAC4B,aAAa,CAACP,SAAS,CAAC;IAChD;EACF;EAEA,OAAOH,cAAc;AACvB"}

package/build/security.js

@@ -5,8 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.defaultSecurity = exports.TIME_EXPIRATION_1H = void 0;
 // TODO: get this from core package
-const TIME_EXPIRATION_1H = '1h';
-exports.TIME_EXPIRATION_1H = TIME_EXPIRATION_1H;
+const TIME_EXPIRATION_1H = exports.TIME_EXPIRATION_1H = '1h';
 const defaultWebTokenOptions = {
   sign: {
     // The expiration token for the website is 7 days
@@ -17,9 +16,8 @@ const defaultWebTokenOptions = {
 const defaultApiTokenConf = {
   legacy: true
 };
-const defaultSecurity = {
+const defaultSecurity = exports.defaultSecurity = {
   web: defaultWebTokenOptions,
   api: defaultApiTokenConf
 };
-exports.defaultSecurity = defaultSecurity;
 //# sourceMappingURL=security.js.map

package/build/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","names":["TIME_EXPIRATION_1H","exports","defaultWebTokenOptions","sign","expiresIn","verify","defaultApiTokenConf","legacy","defaultSecurity","web","api"],"sources":["../src/security.ts"],"sourcesContent":["import { APITokenOptions, JWTOptions, Security } from '@verdaccio/types';\n\n// TODO: get this from core package\nexport const TIME_EXPIRATION_1H = '1h';\n\nconst defaultWebTokenOptions: JWTOptions = {\n  sign: {\n    // The expiration token for the website is 7 days\n    expiresIn: TIME_EXPIRATION_1H,\n  },\n  verify: {},\n};\n\nconst defaultApiTokenConf: APITokenOptions = {\n  legacy: true,\n};\n\nexport const defaultSecurity: Security = {\n  web: defaultWebTokenOptions,\n  api: defaultApiTokenConf,\n};\n"],"mappings":";;;;;;AAEA;AACO,MAAMA,kBAAkB,GAAG,IAAI;AAACC,OAAA,CAAAD,kBAAA,GAAAA,kBAAA;AAEvC,MAAME,sBAAkC,GAAG;EACzCC,IAAI,EAAE;IACJ;IACAC,SAAS,EAAEJ;EACb,CAAC;EACDK,MAAM,EAAE,CAAC;AACX,CAAC;AAED,MAAMC,mBAAoC,GAAG;EAC3CC,MAAM,EAAE;AACV,CAAC;AAEM,MAAMC,eAAyB,GAAG;EACvCC,GAAG,EAAEP,sBAAsB;EAC3BQ,GAAG,EAAEJ;AACP,CAAC;AAACL,OAAA,CAAAO,eAAA,GAAAA,eAAA"}
+{"version":3,"file":"security.js","names":["TIME_EXPIRATION_1H","exports","defaultWebTokenOptions","sign","expiresIn","verify","defaultApiTokenConf","legacy","defaultSecurity","web","api"],"sources":["../src/security.ts"],"sourcesContent":["import { APITokenOptions, JWTOptions, Security } from '@verdaccio/types';\n\n// TODO: get this from core package\nexport const TIME_EXPIRATION_1H = '1h';\n\nconst defaultWebTokenOptions: JWTOptions = {\n  sign: {\n    // The expiration token for the website is 7 days\n    expiresIn: TIME_EXPIRATION_1H,\n  },\n  verify: {},\n};\n\nconst defaultApiTokenConf: APITokenOptions = {\n  legacy: true,\n};\n\nexport const defaultSecurity: Security = {\n  web: defaultWebTokenOptions,\n  api: defaultApiTokenConf,\n};\n"],"mappings":";;;;;;AAEA;AACO,MAAMA,kBAAkB,GAAAC,OAAA,CAAAD,kBAAA,GAAG,IAAI;AAEtC,MAAME,sBAAkC,GAAG;EACzCC,IAAI,EAAE;IACJ;IACAC,SAAS,EAAEJ;EACb,CAAC;EACDK,MAAM,EAAE,CAAC;AACX,CAAC;AAED,MAAMC,mBAAoC,GAAG;EAC3CC,MAAM,EAAE;AACV,CAAC;AAEM,MAAMC,eAAyB,GAAAP,OAAA,CAAAO,eAAA,GAAG;EACvCC,GAAG,EAAEP,sBAAsB;EAC3BQ,GAAG,EAAEJ;AACP,CAAC"}

package/build/serverSettings.js

@@ -4,7 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.default = void 0;
-var _default = {
+var _default = exports.default = {
   // https://www.npmjs.com/package/express-rate-limit
   // values are intended to be high, please customize based on own needs
   rateLimit: {
@@ -14,5 +14,4 @@ var _default = {
   // deprecated
   keepAliveTimeout: 60
 };
-exports.default = _default;
 //# sourceMappingURL=serverSettings.js.map

package/build/serverSettings.js.map

@@ -1 +1 @@
-{"version":3,"file":"serverSettings.js","names":["rateLimit","windowMs","max","keepAliveTimeout","exports","default","_default"],"sources":["../src/serverSettings.ts"],"sourcesContent":["export default {\n  // https://www.npmjs.com/package/express-rate-limit\n  // values are intended to be high, please customize based on own needs\n  rateLimit: {\n    windowMs: 1000,\n    max: 10000,\n  },\n  // deprecated\n  keepAliveTimeout: 60,\n};\n"],"mappings":";;;;;;eAAe;EACb;EACA;EACAA,SAAS,EAAE;IACTC,QAAQ,EAAE,IAAI;IACdC,GAAG,EAAE;EACP,CAAC;EACD;EACAC,gBAAgB,EAAE;AACpB,CAAC;AAAAC,OAAA,CAAAC,OAAA,GAAAC,QAAA"}
+{"version":3,"file":"serverSettings.js","names":["rateLimit","windowMs","max","keepAliveTimeout"],"sources":["../src/serverSettings.ts"],"sourcesContent":["export default {\n  // https://www.npmjs.com/package/express-rate-limit\n  // values are intended to be high, please customize based on own needs\n  rateLimit: {\n    windowMs: 1000,\n    max: 10000,\n  },\n  // deprecated\n  keepAliveTimeout: 60,\n};\n"],"mappings":";;;;;;iCAAe;EACb;EACA;EACAA,SAAS,EAAE;IACTC,QAAQ,EAAE,IAAI;IACdC,GAAG,EAAE;EACP,CAAC;EACD;EACAC,gBAAgB,EAAE;AACpB,CAAC"}

package/build/token.js

@@ -6,12 +6,11 @@ Object.defineProperty(exports, "__esModule", {
 exports.TOKEN_VALID_LENGTH = void 0;
 exports.generateRandomSecretKey = generateRandomSecretKey;
 var _crypto = require("crypto");
-const TOKEN_VALID_LENGTH = 32;
+const TOKEN_VALID_LENGTH = exports.TOKEN_VALID_LENGTH = 32;
 
 /**
  * Secret key must have 32 characters.
  */
-exports.TOKEN_VALID_LENGTH = TOKEN_VALID_LENGTH;
 function generateRandomSecretKey() {
   return (0, _crypto.randomBytes)(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);
 }

package/build/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","names":["_crypto","require","TOKEN_VALID_LENGTH","exports","generateRandomSecretKey","randomBytes","toString","substring"],"sources":["../src/token.ts"],"sourcesContent":["import { randomBytes } from 'crypto';\n\nexport const TOKEN_VALID_LENGTH = 32;\n\n/**\n * Secret key must have 32 characters.\n */\nexport function generateRandomSecretKey(): string {\n  return randomBytes(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAEO,MAAMC,kBAAkB,GAAG,EAAE;;AAEpC;AACA;AACA;AAFAC,OAAA,CAAAD,kBAAA,GAAAA,kBAAA;AAGO,SAASE,uBAAuBA,CAAA,EAAW;EAChD,OAAO,IAAAC,mBAAW,EAACH,kBAAkB,CAAC,CAACI,QAAQ,CAAC,QAAQ,CAAC,CAACC,SAAS,CAAC,CAAC,EAAEL,kBAAkB,CAAC;AAC5F"}
+{"version":3,"file":"token.js","names":["_crypto","require","TOKEN_VALID_LENGTH","exports","generateRandomSecretKey","randomBytes","toString","substring"],"sources":["../src/token.ts"],"sourcesContent":["import { randomBytes } from 'crypto';\n\nexport const TOKEN_VALID_LENGTH = 32;\n\n/**\n * Secret key must have 32 characters.\n */\nexport function generateRandomSecretKey(): string {\n  return randomBytes(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAEO,MAAMC,kBAAkB,GAAAC,OAAA,CAAAD,kBAAA,GAAG,EAAE;;AAEpC;AACA;AACA;AACO,SAASE,uBAAuBA,CAAA,EAAW;EAChD,OAAO,IAAAC,mBAAW,EAACH,kBAAkB,CAAC,CAACI,QAAQ,CAAC,QAAQ,CAAC,CAACC,SAAS,CAAC,CAAC,EAAEL,kBAAkB,CAAC;AAC5F"}

package/build/uplinks.js

@@ -12,10 +12,8 @@ var _assert = _interopRequireDefault(require("assert"));
 var _lodash = _interopRequireDefault(require("lodash"));
 var _utils = require("@verdaccio/utils");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-const DEFAULT_REGISTRY = 'https://registry.npmjs.org';
-exports.DEFAULT_REGISTRY = DEFAULT_REGISTRY;
-const DEFAULT_UPLINK = 'npmjs';
-exports.DEFAULT_UPLINK = DEFAULT_UPLINK;
+const DEFAULT_REGISTRY = exports.DEFAULT_REGISTRY = 'https://registry.npmjs.org';
+const DEFAULT_UPLINK = exports.DEFAULT_UPLINK = 'npmjs';
 const BLACKLIST = {
   all: true,
   anonymous: true,

package/build/uplinks.js.map

@@ -1 +1 @@
-{"version":3,"file":"uplinks.js","names":["_assert","_interopRequireDefault","require","_lodash","_utils","obj","__esModule","default","DEFAULT_REGISTRY","exports","DEFAULT_UPLINK","BLACKLIST","all","anonymous","undefined","owner","none","uplinkSanityCheck","uplinks","users","newUplinks","_","clone","newUsers","uplink","Object","prototype","hasOwnProperty","call","cache","sanityCheckNames","sanityCheckUplinksProps","configUpLinks","assert","url","isString","replace","hasProxyTo","pkg","upLink","packages","matchedPkg","getMatchedPackagesSpec","proxyList","proxy","some","curr","item","match","isNil"],"sources":["../src/uplinks.ts"],"sourcesContent":["import assert from 'assert';\nimport _ from 'lodash';\n\nimport { PackageList, UpLinksConfList } from '@verdaccio/types';\nimport { getMatchedPackagesSpec } from '@verdaccio/utils';\n\nexport const DEFAULT_REGISTRY = 'https://registry.npmjs.org';\nexport const DEFAULT_UPLINK = 'npmjs';\n\nconst BLACKLIST = {\n  all: true,\n  anonymous: true,\n  undefined: true,\n  owner: true,\n  none: true,\n};\n\nexport function uplinkSanityCheck(\n  uplinks: UpLinksConfList,\n  users: any = BLACKLIST\n): UpLinksConfList {\n  const newUplinks = _.clone(uplinks);\n  let newUsers = _.clone(users);\n\n  for (const uplink in newUplinks) {\n    if (Object.prototype.hasOwnProperty.call(newUplinks, uplink)) {\n      if (typeof newUplinks[uplink].cache === 'undefined') {\n        newUplinks[uplink].cache = true;\n      }\n      newUsers = sanityCheckNames(uplink, newUsers);\n    }\n  }\n\n  return newUplinks;\n}\n\nexport function sanityCheckUplinksProps(configUpLinks: UpLinksConfList): UpLinksConfList {\n  const uplinks = _.clone(configUpLinks);\n\n  for (const uplink in uplinks) {\n    if (Object.prototype.hasOwnProperty.call(uplinks, uplink)) {\n      assert(uplinks[uplink].url, 'CONFIG: no url for uplink: ' + uplink);\n      assert(_.isString(uplinks[uplink].url), 'CONFIG: wrong url format for uplink: ' + uplink);\n      uplinks[uplink].url = uplinks[uplink].url.replace(/\\/$/, '');\n    }\n  }\n\n  return uplinks;\n}\n\nexport function hasProxyTo(pkg: string, upLink: string, packages: PackageList): boolean {\n  const matchedPkg = getMatchedPackagesSpec(pkg, packages);\n  const proxyList = typeof matchedPkg !== 'undefined' ? matchedPkg.proxy : [];\n  if (proxyList) {\n    return proxyList.some((curr) => upLink === curr);\n  }\n\n  return false;\n}\n\nexport function sanityCheckNames(item: string, users: any): any {\n  assert(\n    item !== 'all' &&\n      item !== 'owner' &&\n      item !== 'anonymous' &&\n      item !== 'undefined' &&\n      item !== 'none',\n    'CONFIG: reserved uplink name: ' + item\n  );\n  assert(!item.match(/\\s/), 'CONFIG: invalid uplink name: ' + item);\n  assert(_.isNil(users[item]), 'CONFIG: duplicate uplink name: ' + item);\n  users[item] = true;\n\n  return users;\n}\n"],"mappings":";;;;;;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAGA,IAAAE,MAAA,GAAAF,OAAA;AAA0D,SAAAD,uBAAAI,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEnD,MAAMG,gBAAgB,GAAG,4BAA4B;AAACC,OAAA,CAAAD,gBAAA,GAAAA,gBAAA;AACtD,MAAME,cAAc,GAAG,OAAO;AAACD,OAAA,CAAAC,cAAA,GAAAA,cAAA;AAEtC,MAAMC,SAAS,GAAG;EAChBC,GAAG,EAAE,IAAI;EACTC,SAAS,EAAE,IAAI;EACfC,SAAS,EAAE,IAAI;EACfC,KAAK,EAAE,IAAI;EACXC,IAAI,EAAE;AACR,CAAC;AAEM,SAASC,iBAAiBA,CAC/BC,OAAwB,EACxBC,KAAU,GAAGR,SAAS,EACL;EACjB,MAAMS,UAAU,GAAGC,eAAC,CAACC,KAAK,CAACJ,OAAO,CAAC;EACnC,IAAIK,QAAQ,GAAGF,eAAC,CAACC,KAAK,CAACH,KAAK,CAAC;EAE7B,KAAK,MAAMK,MAAM,IAAIJ,UAAU,EAAE;IAC/B,IAAIK,MAAM,CAACC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACR,UAAU,EAAEI,MAAM,CAAC,EAAE;MAC5D,IAAI,OAAOJ,UAAU,CAACI,MAAM,CAAC,CAACK,KAAK,KAAK,WAAW,EAAE;QACnDT,UAAU,CAACI,MAAM,CAAC,CAACK,KAAK,GAAG,IAAI;MACjC;MACAN,QAAQ,GAAGO,gBAAgB,CAACN,MAAM,EAAED,QAAQ,CAAC;IAC/C;EACF;EAEA,OAAOH,UAAU;AACnB;AAEO,SAASW,uBAAuBA,CAACC,aAA8B,EAAmB;EACvF,MAAMd,OAAO,GAAGG,eAAC,CAACC,KAAK,CAACU,aAAa,CAAC;EAEtC,KAAK,MAAMR,MAAM,IAAIN,OAAO,EAAE;IAC5B,IAAIO,MAAM,CAACC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACV,OAAO,EAAEM,MAAM,CAAC,EAAE;MACzD,IAAAS,eAAM,EAACf,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,EAAE,6BAA6B,GAAGV,MAAM,CAAC;MACnE,IAAAS,eAAM,EAACZ,eAAC,CAACc,QAAQ,CAACjB,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,CAAC,EAAE,uCAAuC,GAAGV,MAAM,CAAC;MACzFN,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,GAAGhB,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,CAACE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9D;EACF;EAEA,OAAOlB,OAAO;AAChB;AAEO,SAASmB,UAAUA,CAACC,GAAW,EAAEC,MAAc,EAAEC,QAAqB,EAAW;EACtF,MAAMC,UAAU,GAAG,IAAAC,6BAAsB,EAACJ,GAAG,EAAEE,QAAQ,CAAC;EACxD,MAAMG,SAAS,GAAG,OAAOF,UAAU,KAAK,WAAW,GAAGA,UAAU,CAACG,KAAK,GAAG,EAAE;EAC3E,IAAID,SAAS,EAAE;IACb,OAAOA,SAAS,CAACE,IAAI,CAAEC,IAAI,IAAKP,MAAM,KAAKO,IAAI,CAAC;EAClD;EAEA,OAAO,KAAK;AACd;AAEO,SAAShB,gBAAgBA,CAACiB,IAAY,EAAE5B,KAAU,EAAO;EAC9D,IAAAc,eAAM,EACJc,IAAI,KAAK,KAAK,IACZA,IAAI,KAAK,OAAO,IAChBA,IAAI,KAAK,WAAW,IACpBA,IAAI,KAAK,WAAW,IACpBA,IAAI,KAAK,MAAM,EACjB,gCAAgC,GAAGA,IACrC,CAAC;EACD,IAAAd,eAAM,EAAC,CAACc,IAAI,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,+BAA+B,GAAGD,IAAI,CAAC;EACjE,IAAAd,eAAM,EAACZ,eAAC,CAAC4B,KAAK,CAAC9B,KAAK,CAAC4B,IAAI,CAAC,CAAC,EAAE,iCAAiC,GAAGA,IAAI,CAAC;EACtE5B,KAAK,CAAC4B,IAAI,CAAC,GAAG,IAAI;EAElB,OAAO5B,KAAK;AACd"}
+{"version":3,"file":"uplinks.js","names":["_assert","_interopRequireDefault","require","_lodash","_utils","obj","__esModule","default","DEFAULT_REGISTRY","exports","DEFAULT_UPLINK","BLACKLIST","all","anonymous","undefined","owner","none","uplinkSanityCheck","uplinks","users","newUplinks","_","clone","newUsers","uplink","Object","prototype","hasOwnProperty","call","cache","sanityCheckNames","sanityCheckUplinksProps","configUpLinks","assert","url","isString","replace","hasProxyTo","pkg","upLink","packages","matchedPkg","getMatchedPackagesSpec","proxyList","proxy","some","curr","item","match","isNil"],"sources":["../src/uplinks.ts"],"sourcesContent":["import assert from 'assert';\nimport _ from 'lodash';\n\nimport { PackageList, UpLinksConfList } from '@verdaccio/types';\nimport { getMatchedPackagesSpec } from '@verdaccio/utils';\n\nexport const DEFAULT_REGISTRY = 'https://registry.npmjs.org';\nexport const DEFAULT_UPLINK = 'npmjs';\n\nconst BLACKLIST = {\n  all: true,\n  anonymous: true,\n  undefined: true,\n  owner: true,\n  none: true,\n};\n\nexport function uplinkSanityCheck(\n  uplinks: UpLinksConfList,\n  users: any = BLACKLIST\n): UpLinksConfList {\n  const newUplinks = _.clone(uplinks);\n  let newUsers = _.clone(users);\n\n  for (const uplink in newUplinks) {\n    if (Object.prototype.hasOwnProperty.call(newUplinks, uplink)) {\n      if (typeof newUplinks[uplink].cache === 'undefined') {\n        newUplinks[uplink].cache = true;\n      }\n      newUsers = sanityCheckNames(uplink, newUsers);\n    }\n  }\n\n  return newUplinks;\n}\n\nexport function sanityCheckUplinksProps(configUpLinks: UpLinksConfList): UpLinksConfList {\n  const uplinks = _.clone(configUpLinks);\n\n  for (const uplink in uplinks) {\n    if (Object.prototype.hasOwnProperty.call(uplinks, uplink)) {\n      assert(uplinks[uplink].url, 'CONFIG: no url for uplink: ' + uplink);\n      assert(_.isString(uplinks[uplink].url), 'CONFIG: wrong url format for uplink: ' + uplink);\n      uplinks[uplink].url = uplinks[uplink].url.replace(/\\/$/, '');\n    }\n  }\n\n  return uplinks;\n}\n\nexport function hasProxyTo(pkg: string, upLink: string, packages: PackageList): boolean {\n  const matchedPkg = getMatchedPackagesSpec(pkg, packages);\n  const proxyList = typeof matchedPkg !== 'undefined' ? matchedPkg.proxy : [];\n  if (proxyList) {\n    return proxyList.some((curr) => upLink === curr);\n  }\n\n  return false;\n}\n\nexport function sanityCheckNames(item: string, users: any): any {\n  assert(\n    item !== 'all' &&\n      item !== 'owner' &&\n      item !== 'anonymous' &&\n      item !== 'undefined' &&\n      item !== 'none',\n    'CONFIG: reserved uplink name: ' + item\n  );\n  assert(!item.match(/\\s/), 'CONFIG: invalid uplink name: ' + item);\n  assert(_.isNil(users[item]), 'CONFIG: duplicate uplink name: ' + item);\n  users[item] = true;\n\n  return users;\n}\n"],"mappings":";;;;;;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAGA,IAAAE,MAAA,GAAAF,OAAA;AAA0D,SAAAD,uBAAAI,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEnD,MAAMG,gBAAgB,GAAAC,OAAA,CAAAD,gBAAA,GAAG,4BAA4B;AACrD,MAAME,cAAc,GAAAD,OAAA,CAAAC,cAAA,GAAG,OAAO;AAErC,MAAMC,SAAS,GAAG;EAChBC,GAAG,EAAE,IAAI;EACTC,SAAS,EAAE,IAAI;EACfC,SAAS,EAAE,IAAI;EACfC,KAAK,EAAE,IAAI;EACXC,IAAI,EAAE;AACR,CAAC;AAEM,SAASC,iBAAiBA,CAC/BC,OAAwB,EACxBC,KAAU,GAAGR,SAAS,EACL;EACjB,MAAMS,UAAU,GAAGC,eAAC,CAACC,KAAK,CAACJ,OAAO,CAAC;EACnC,IAAIK,QAAQ,GAAGF,eAAC,CAACC,KAAK,CAACH,KAAK,CAAC;EAE7B,KAAK,MAAMK,MAAM,IAAIJ,UAAU,EAAE;IAC/B,IAAIK,MAAM,CAACC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACR,UAAU,EAAEI,MAAM,CAAC,EAAE;MAC5D,IAAI,OAAOJ,UAAU,CAACI,MAAM,CAAC,CAACK,KAAK,KAAK,WAAW,EAAE;QACnDT,UAAU,CAACI,MAAM,CAAC,CAACK,KAAK,GAAG,IAAI;MACjC;MACAN,QAAQ,GAAGO,gBAAgB,CAACN,MAAM,EAAED,QAAQ,CAAC;IAC/C;EACF;EAEA,OAAOH,UAAU;AACnB;AAEO,SAASW,uBAAuBA,CAACC,aAA8B,EAAmB;EACvF,MAAMd,OAAO,GAAGG,eAAC,CAACC,KAAK,CAACU,aAAa,CAAC;EAEtC,KAAK,MAAMR,MAAM,IAAIN,OAAO,EAAE;IAC5B,IAAIO,MAAM,CAACC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACV,OAAO,EAAEM,MAAM,CAAC,EAAE;MACzD,IAAAS,eAAM,EAACf,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,EAAE,6BAA6B,GAAGV,MAAM,CAAC;MACnE,IAAAS,eAAM,EAACZ,eAAC,CAACc,QAAQ,CAACjB,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,CAAC,EAAE,uCAAuC,GAAGV,MAAM,CAAC;MACzFN,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,GAAGhB,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,CAACE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9D;EACF;EAEA,OAAOlB,OAAO;AAChB;AAEO,SAASmB,UAAUA,CAACC,GAAW,EAAEC,MAAc,EAAEC,QAAqB,EAAW;EACtF,MAAMC,UAAU,GAAG,IAAAC,6BAAsB,EAACJ,GAAG,EAAEE,QAAQ,CAAC;EACxD,MAAMG,SAAS,GAAG,OAAOF,UAAU,KAAK,WAAW,GAAGA,UAAU,CAACG,KAAK,GAAG,EAAE;EAC3E,IAAID,SAAS,EAAE;IACb,OAAOA,SAAS,CAACE,IAAI,CAAEC,IAAI,IAAKP,MAAM,KAAKO,IAAI,CAAC;EAClD;EAEA,OAAO,KAAK;AACd;AAEO,SAAShB,gBAAgBA,CAACiB,IAAY,EAAE5B,KAAU,EAAO;EAC9D,IAAAc,eAAM,EACJc,IAAI,KAAK,KAAK,IACZA,IAAI,KAAK,OAAO,IAChBA,IAAI,KAAK,WAAW,IACpBA,IAAI,KAAK,WAAW,IACpBA,IAAI,KAAK,MAAM,EACjB,gCAAgC,GAAGA,IACrC,CAAC;EACD,IAAAd,eAAM,EAAC,CAACc,IAAI,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,+BAA+B,GAAGD,IAAI,CAAC;EACjE,IAAAd,eAAM,EAACZ,eAAC,CAAC4B,KAAK,CAAC9B,KAAK,CAAC4B,IAAI,CAAC,CAAC,EAAE,iCAAiC,GAAGA,IAAI,CAAC;EACtE5B,KAAK,CAAC4B,IAAI,CAAC,GAAG,IAAI;EAElB,OAAO5B,KAAK;AACd"}

package/build/user.js

@@ -10,12 +10,11 @@ var _packageAccess = require("./package-access");
 /**
  * All logged users will have by default the group $all and $authenticate
  */
-const defaultLoggedUserRoles = [_packageAccess.ROLES.$ALL, _packageAccess.ROLES.$AUTH, _packageAccess.ROLES.DEPRECATED_ALL, _packageAccess.ROLES.DEPRECATED_AUTH, _packageAccess.ROLES.ALL];
+const defaultLoggedUserRoles = exports.defaultLoggedUserRoles = [_packageAccess.ROLES.$ALL, _packageAccess.ROLES.$AUTH, _packageAccess.ROLES.DEPRECATED_ALL, _packageAccess.ROLES.DEPRECATED_AUTH, _packageAccess.ROLES.ALL];
 /**
  *
  */
-exports.defaultLoggedUserRoles = defaultLoggedUserRoles;
-const defaultNonLoggedUserRoles = [_packageAccess.ROLES.$ALL, _packageAccess.ROLES.$ANONYMOUS,
+const defaultNonLoggedUserRoles = exports.defaultNonLoggedUserRoles = [_packageAccess.ROLES.$ALL, _packageAccess.ROLES.$ANONYMOUS,
 // groups without '$' are going to be deprecated eventually
 _packageAccess.ROLES.DEPRECATED_ALL, _packageAccess.ROLES.DEPRECATED_ANONYMOUS];
 
@@ -23,7 +22,6 @@ _packageAccess.ROLES.DEPRECATED_ALL, _packageAccess.ROLES.DEPRECATED_ANONYMOUS];
  * Create a RemoteUser object
  * @return {Object} { name: xx, pluginGroups: [], real_groups: [] }
  */
-exports.defaultNonLoggedUserRoles = defaultNonLoggedUserRoles;
 function createRemoteUser(name, pluginGroups) {
   const isGroupValid = Array.isArray(pluginGroups);
   const groups = Array.from(new Set((isGroupValid ? pluginGroups : []).concat([...defaultLoggedUserRoles])));

package/build/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","names":["_packageAccess","require","defaultLoggedUserRoles","ROLES","$ALL","$AUTH","DEPRECATED_ALL","DEPRECATED_AUTH","ALL","exports","defaultNonLoggedUserRoles","$ANONYMOUS","DEPRECATED_ANONYMOUS","createRemoteUser","name","pluginGroups","isGroupValid","Array","isArray","groups","from","Set","concat","real_groups","createAnonymousRemoteUser","undefined"],"sources":["../src/user.ts"],"sourcesContent":["import { RemoteUser } from '@verdaccio/types';\n\nimport { ROLES } from './package-access';\n\n/**\n * All logged users will have by default the group $all and $authenticate\n */\nexport const defaultLoggedUserRoles = [\n  ROLES.$ALL,\n  ROLES.$AUTH,\n  ROLES.DEPRECATED_ALL,\n  ROLES.DEPRECATED_AUTH,\n  ROLES.ALL,\n];\n/**\n *\n */\nexport const defaultNonLoggedUserRoles = [\n  ROLES.$ALL,\n  ROLES.$ANONYMOUS,\n  // groups without '$' are going to be deprecated eventually\n  ROLES.DEPRECATED_ALL,\n  ROLES.DEPRECATED_ANONYMOUS,\n];\n\n/**\n * Create a RemoteUser object\n * @return {Object} { name: xx, pluginGroups: [], real_groups: [] }\n */\nexport function createRemoteUser(name: string, pluginGroups: string[]): RemoteUser {\n  const isGroupValid: boolean = Array.isArray(pluginGroups);\n  const groups = Array.from(\n    new Set((isGroupValid ? pluginGroups : []).concat([...defaultLoggedUserRoles]))\n  );\n\n  return {\n    name,\n    groups,\n    real_groups: pluginGroups,\n  };\n}\n\n/**\n * Builds an anonymous remote user in case none is logged in.\n * @return {Object} { name: xx, groups: [], real_groups: [] }\n */\nexport function createAnonymousRemoteUser(): RemoteUser {\n  return {\n    name: undefined,\n    groups: [...defaultNonLoggedUserRoles],\n    real_groups: [],\n  };\n}\n"],"mappings":";;;;;;;;AAEA,IAAAA,cAAA,GAAAC,OAAA;AAEA;AACA;AACA;AACO,MAAMC,sBAAsB,GAAG,CACpCC,oBAAK,CAACC,IAAI,EACVD,oBAAK,CAACE,KAAK,EACXF,oBAAK,CAACG,cAAc,EACpBH,oBAAK,CAACI,eAAe,EACrBJ,oBAAK,CAACK,GAAG,CACV;AACD;AACA;AACA;AAFAC,OAAA,CAAAP,sBAAA,GAAAA,sBAAA;AAGO,MAAMQ,yBAAyB,GAAG,CACvCP,oBAAK,CAACC,IAAI,EACVD,oBAAK,CAACQ,UAAU;AAChB;AACAR,oBAAK,CAACG,cAAc,EACpBH,oBAAK,CAACS,oBAAoB,CAC3B;;AAED;AACA;AACA;AACA;AAHAH,OAAA,CAAAC,yBAAA,GAAAA,yBAAA;AAIO,SAASG,gBAAgBA,CAACC,IAAY,EAAEC,YAAsB,EAAc;EACjF,MAAMC,YAAqB,GAAGC,KAAK,CAACC,OAAO,CAACH,YAAY,CAAC;EACzD,MAAMI,MAAM,GAAGF,KAAK,CAACG,IAAI,CACvB,IAAIC,GAAG,CAAC,CAACL,YAAY,GAAGD,YAAY,GAAG,EAAE,EAAEO,MAAM,CAAC,CAAC,GAAGpB,sBAAsB,CAAC,CAAC,CAChF,CAAC;EAED,OAAO;IACLY,IAAI;IACJK,MAAM;IACNI,WAAW,EAAER;EACf,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACO,SAASS,yBAAyBA,CAAA,EAAe;EACtD,OAAO;IACLV,IAAI,EAAEW,SAAS;IACfN,MAAM,EAAE,CAAC,GAAGT,yBAAyB,CAAC;IACtCa,WAAW,EAAE;EACf,CAAC;AACH"}
+{"version":3,"file":"user.js","names":["_packageAccess","require","defaultLoggedUserRoles","exports","ROLES","$ALL","$AUTH","DEPRECATED_ALL","DEPRECATED_AUTH","ALL","defaultNonLoggedUserRoles","$ANONYMOUS","DEPRECATED_ANONYMOUS","createRemoteUser","name","pluginGroups","isGroupValid","Array","isArray","groups","from","Set","concat","real_groups","createAnonymousRemoteUser","undefined"],"sources":["../src/user.ts"],"sourcesContent":["import { RemoteUser } from '@verdaccio/types';\n\nimport { ROLES } from './package-access';\n\n/**\n * All logged users will have by default the group $all and $authenticate\n */\nexport const defaultLoggedUserRoles = [\n  ROLES.$ALL,\n  ROLES.$AUTH,\n  ROLES.DEPRECATED_ALL,\n  ROLES.DEPRECATED_AUTH,\n  ROLES.ALL,\n];\n/**\n *\n */\nexport const defaultNonLoggedUserRoles = [\n  ROLES.$ALL,\n  ROLES.$ANONYMOUS,\n  // groups without '$' are going to be deprecated eventually\n  ROLES.DEPRECATED_ALL,\n  ROLES.DEPRECATED_ANONYMOUS,\n];\n\n/**\n * Create a RemoteUser object\n * @return {Object} { name: xx, pluginGroups: [], real_groups: [] }\n */\nexport function createRemoteUser(name: string, pluginGroups: string[]): RemoteUser {\n  const isGroupValid: boolean = Array.isArray(pluginGroups);\n  const groups = Array.from(\n    new Set((isGroupValid ? pluginGroups : []).concat([...defaultLoggedUserRoles]))\n  );\n\n  return {\n    name,\n    groups,\n    real_groups: pluginGroups,\n  };\n}\n\n/**\n * Builds an anonymous remote user in case none is logged in.\n * @return {Object} { name: xx, groups: [], real_groups: [] }\n */\nexport function createAnonymousRemoteUser(): RemoteUser {\n  return {\n    name: undefined,\n    groups: [...defaultNonLoggedUserRoles],\n    real_groups: [],\n  };\n}\n"],"mappings":";;;;;;;;AAEA,IAAAA,cAAA,GAAAC,OAAA;AAEA;AACA;AACA;AACO,MAAMC,sBAAsB,GAAAC,OAAA,CAAAD,sBAAA,GAAG,CACpCE,oBAAK,CAACC,IAAI,EACVD,oBAAK,CAACE,KAAK,EACXF,oBAAK,CAACG,cAAc,EACpBH,oBAAK,CAACI,eAAe,EACrBJ,oBAAK,CAACK,GAAG,CACV;AACD;AACA;AACA;AACO,MAAMC,yBAAyB,GAAAP,OAAA,CAAAO,yBAAA,GAAG,CACvCN,oBAAK,CAACC,IAAI,EACVD,oBAAK,CAACO,UAAU;AAChB;AACAP,oBAAK,CAACG,cAAc,EACpBH,oBAAK,CAACQ,oBAAoB,CAC3B;;AAED;AACA;AACA;AACA;AACO,SAASC,gBAAgBA,CAACC,IAAY,EAAEC,YAAsB,EAAc;EACjF,MAAMC,YAAqB,GAAGC,KAAK,CAACC,OAAO,CAACH,YAAY,CAAC;EACzD,MAAMI,MAAM,GAAGF,KAAK,CAACG,IAAI,CACvB,IAAIC,GAAG,CAAC,CAACL,YAAY,GAAGD,YAAY,GAAG,EAAE,EAAEO,MAAM,CAAC,CAAC,GAAGpB,sBAAsB,CAAC,CAAC,CAChF,CAAC;EAED,OAAO;IACLY,IAAI;IACJK,MAAM;IACNI,WAAW,EAAER;EACf,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACO,SAASS,yBAAyBA,CAAA,EAAe;EACtD,OAAO;IACLV,IAAI,EAAEW,SAAS;IACfN,MAAM,EAAE,CAAC,GAAGT,yBAAyB,CAAC;IACtCa,WAAW,EAAE;EACf,CAAC;AACH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/config",
-  "version": "7.0.0-next.3",
+  "version": "7.0.0-next.5",
   "description": "logger",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -29,8 +29,8 @@
     "node": ">=12"
   },
   "dependencies": {
-    "@verdaccio/core": "7.0.0-next.3",
-    "@verdaccio/utils": "7.0.0-next.3",
+    "@verdaccio/core": "7.0.0-next.5",
+    "@verdaccio/utils": "7.0.0-next.5",
     "debug": "4.3.4",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",
@@ -39,7 +39,7 @@
   },
   "devDependencies": {
     "@types/minimatch": "5.1.2",
-    "@types/yup": "0.29.14"
+    "@types/yup": "0.32.0"
   },
   "funding": {
     "type": "opencollective",

package/src/config.ts

@@ -63,6 +63,10 @@ class Config implements AppConfig {
   private configOptions: { forceEnhancedLegacySignature: boolean };
   public constructor(
     config: ConfigYaml & { config_path: string },
+    // forceEnhancedLegacySignature is a property that
+    // allows switch a new legacy aes signature token signature
+    // for older versions do not want to have this new signature model
+    // this property must be false
     configOptions = { forceEnhancedLegacySignature: true }
   ) {
     const self = this;
@@ -131,6 +135,16 @@ class Config implements AppConfig {
     }
   }
 
+  public getEnhancedLegacySignature() {
+    if (typeof this?.security.enhancedLegacySignature !== 'undefined') {
+      if (this.security.enhancedLegacySignature === true) {
+        return true;
+      }
+      return false;
+    }
+    return this.configOptions.forceEnhancedLegacySignature;
+  }
+
   public getConfigPath() {
     return this.configPath;
   }
@@ -156,24 +170,23 @@ class Config implements AppConfig {
     }
     // generate a new a secret key
     // FUTURE: this might be an external secret key, perhaps within config file?
-    debug('generate a new key');
-    //
-    if (this.configOptions.forceEnhancedLegacySignature) {
+    debug('generating a new secret key');
+
+    if (this.getEnhancedLegacySignature()) {
+      debug('key generated with "enhanced" legacy signature user config');
       this.secret = generateRandomSecretKey();
     } else {
-      this.secret =
-        this.security.enhancedLegacySignature === true
-          ? generateRandomSecretKey()
-          : generateRandomHexString(32);
-      // set this to false allow use old token signature and is not recommended
-      // only use for migration reasons, major release will remove this property and
-      // set it by default
-      if (this.security.enhancedLegacySignature === false) {
-        warningUtils.emit(Codes.VERWAR005);
-      }
+      debug('key generated with legacy signature user config');
+      this.secret = generateRandomHexString(32);
+    }
+    // set this to false allow use old token signature and is not recommended
+    // only use for migration reasons, major release will remove this property and
+    // set it by default
+    if (this.security?.enhancedLegacySignature === false) {
+      warningUtils.emit(Codes.VERWAR005);
     }
 
-    debug('generated a new secret key %s', this.secret?.length);
+    debug('generated a new secret key length %s', this.secret?.length);
     return this.secret;
   }
 }